chore(deps)!: Update GitHub Actions (major)#34
Conversation
WalkthroughThis PR updates GitHub Actions to newer pinned versions across seven workflow files (.github/workflows/ci.yml, codeql.yml, dependency-review.yml, pr-validation.yml, publish-artifact-registry.yml, release.yml, and slsa-provenance.yml). No workflow logic, job conditions, command execution, or configuration is altered—only action version pins are bumped. ChangesGitHub Actions Version Upgrades
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
williaby
force-pushed
the
renovate/major-github-actions
branch
from
25ac03c to
7be1c28
Compare
There was a problem hiding this comment.
Pull request overview
Updates pinned GitHub Actions across the repository’s CI/CD workflows to newer major versions (primarily moving to Node 24–based action runtimes and newer action feature sets).
Changes:
- Bumps core CI actions (checkout, setup-python, setup-uv, artifact upload/download) to new major versions across workflows.
- Updates security/scanning actions (CodeQL) and coverage upload (Codecov) to new major versions.
- Updates release/publishing workflows (python-semantic-release, google-github-actions/auth, setup-gcloud) to new major versions.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/slsa-provenance.yml | Updates checkout/setup-python/setup-uv/upload-artifact and attest-build-provenance pins for provenance generation. |
| .github/workflows/release.yml | Updates checkout/setup-uv and python-semantic-release action pins for the release workflow. |
| .github/workflows/publish-artifact-registry.yml | Updates checkout/setup-uv and Google Cloud auth/setup-gcloud pins for publishing to Artifact Registry. |
| .github/workflows/pr-validation.yml | Updates checkout and setup-uv pins for PR validation/dead-code job setup. |
| .github/workflows/dependency-review.yml | Updates checkout pin for dependency review workflow. |
| .github/workflows/codeql.yml | Updates checkout/setup-python/setup-uv and CodeQL init/analyze pins. |
| .github/workflows/ci.yml | Updates checkout/paths-filter/setup-uv/artifact download+upload and Codecov action pins in CI. |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
|
|
||
| - name: Detect path changes | ||
| uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3.0.3 | ||
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 |
williaby
force-pushed
the
renovate/major-github-actions
branch
2 times, most recently
from
0290e1c to
75116a3
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 45: Update each GitHub Actions checkout step that runs in pull_request
workflows to disable persisted Git credentials by adding the option
persist-credentials: false to the checkout action invocations; specifically
modify the occurrences of "uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" (the checkout steps
present at the referenced locations) so they include a keys block with
persist-credentials: false to prevent supplying repo credentials to subsequent
steps.
In @.github/workflows/pr-validation.yml:
- Line 64: The checkout step currently uses "uses:
actions/checkout@de0fac2e4500d..." without disabling credential persistence;
update the checkout action invocation (the actions/checkout usage) to include a
with: persist-credentials: false setting so the GITHUB_TOKEN is not written into
git config for PR workflows.
In @.github/workflows/publish-artifact-registry.yml:
- Around line 172-175: The workflow is passing a base64-encoded secret into the
google-github-actions/auth step's credentials_json input (the step using
google-github-actions/auth), but credentials_json must receive raw JSON; either
replace the secret with a raw-minified JSON secret (e.g., GCP_SA_KEY_JSON) and
set credentials_json to that secret, or decode the base64 before passing it by
using GitHub Actions functions (e.g., convert base64 to JSON and feed the
result) so the credentials_json parameter receives the actual Service Account
JSON rather than the encoded string.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: d43d58d9-e98b-4258-95cf-98b664275325
📒 Files selected for processing (7)
.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/dependency-review.yml.github/workflows/pr-validation.yml.github/workflows/publish-artifact-registry.yml.github/workflows/release.yml.github/workflows/slsa-provenance.yml
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/ci.yml | head -250Repository: ByronWilliamsCPA/python-libs
Length of output: 9248
Disable persisted Git credentials in all PR-executed checkout actions.
Lines 45, 74, 122, 166, and 191 perform checkout in pull_request workflows. Since none of the subsequent steps require authenticated git operations, add persist-credentials: false to each checkout action to follow the principle of least privilege and reduce attack surface.
Required changes
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: falseApply this change to lines 45, 74, 122, 166, and 191.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 45, Update each GitHub Actions checkout
step that runs in pull_request workflows to disable persisted Git credentials by
adding the option persist-credentials: false to the checkout action invocations;
specifically modify the occurrences of "uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" (the checkout steps
present at the referenced locations) so they include a keys block with
persist-credentials: false to prevent supplying repo credentials to subsequent
steps.
|
|
||
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find and examine the workflow file
find . -path "./.github/workflows/pr-validation.yml" -type fRepository: ByronWilliamsCPA/python-libs
Length of output: 110
🏁 Script executed:
# Read the workflow file to see the context around line 64
cat -n .github/workflows/pr-validation.yml | head -80Repository: ByronWilliamsCPA/python-libs
Length of output: 3282
🏁 Script executed:
# Check the entire workflow for any authenticated git operations
cat -n .github/workflows/pr-validation.yml | tail -20Repository: ByronWilliamsCPA/python-libs
Length of output: 971
🏁 Script executed:
# Also check if there are any other checkout actions or git operations in this file
grep -n "git\|push\|commit\|credentials" .github/workflows/pr-validation.ymlRepository: ByronWilliamsCPA/python-libs
Length of output: 331
Harden checkout by disabling credential persistence.
This job executes repository code from pull requests; keep the GITHUB_TOKEN out of git config since no authenticated git operations are performed.
Suggested hardening
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-validation.yml at line 64, The checkout step currently
uses "uses: actions/checkout@de0fac2e4500d..." without disabling credential
persistence; update the checkout action invocation (the actions/checkout usage)
to include a with: persist-credentials: false setting so the GITHUB_TOKEN is not
written into git config for PR workflows.
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 | ||
| with: | ||
| credentials_json: ${{ secrets.GCP_SA_KEY_BASE64 }} | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat .github/workflows/publish-artifact-registry.ymlRepository: ByronWilliamsCPA/python-libs
Length of output: 8895
🏁 Script executed:
cat .github/workflows/publish-artifact-registry.yml | head -200Repository: ByronWilliamsCPA/python-libs
Length of output: 6976
🏁 Script executed:
cat .github/workflows/publish-artifact-registry.ymlRepository: ByronWilliamsCPA/python-libs
Length of output: 8895
🌐 Web query:
google-github-actions/auth credentials_json format documentation
💡 Result:
The credentials_json input for the google-github-actions/auth GitHub Action expects the raw content of a Google Cloud Service Account Key JSON file [1][2]. To use this input correctly: 1. Format: The value must be the valid JSON object exported from the Google Cloud Console for a Service Account [2]. 2. Storage: It is strongly recommended to store this JSON as a GitHub Actions Secret [1][2]. 3. Best Practice: The documentation advises minifying the JSON into a single-line string before saving it as a GitHub Secret [1]. This prevents issues where GitHub Actions might aggressively sanitize or mask characters (such as curly braces or brackets) if the secret contains multiple lines [1]. 4. Usage in YAML: Reference the secret in your workflow file as follows [1][2]: - uses: 'google-github-actions/auth@v3' with: credentials_json: '${{ secrets.YOUR_SECRET_NAME }}' Important Security Note: Google and the maintainers of google-github-actions/auth strongly prefer using Workload Identity Federation over Service Account Key JSONs [1][3][4]. Workload Identity Federation eliminates the need for long-lived keys, which are a significant security risk if compromised [3][4]. If you must use credentials_json, ensure the service account has the roles/iam.serviceAccountTokenCreator role on itself [1][2].
Citations:
- 1: https://github.com/google-github-actions/auth
- 2: https://github.com/google-github-actions/auth/blob/main/docs/EXAMPLES.md
- 3: https://github.com/google-gemini/gemini-cli-action/blob/a2b9c054/docs/workload-identity.md
- 4: https://cloud.google.com/blog/products/identity-security/enabling-keyless-authentication-from-github-actions
Fix credentials_json to receive raw JSON, not base64-encoded.
The credentials_json parameter for google-github-actions/auth expects the raw JSON content of a Service Account Key. The secret is base64-encoded (as evidenced by the base64 -d decoding on line 192), which will cause authentication to fail at this step.
Store the raw JSON key (minified) as a separate secret (e.g., GCP_SA_KEY_JSON), or decode the base64 before passing it: credentials_json: ${{ fromJSON(base64ToJson(secrets.GCP_SA_KEY_BASE64)) }} if using base64.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish-artifact-registry.yml around lines 172 - 175, The
workflow is passing a base64-encoded secret into the google-github-actions/auth
step's credentials_json input (the step using google-github-actions/auth), but
credentials_json must receive raw JSON; either replace the secret with a
raw-minified JSON secret (e.g., GCP_SA_KEY_JSON) and set credentials_json to
that secret, or decode the base64 before passing it by using GitHub Actions
functions (e.g., convert base64 to JSON and feed the result) so the
credentials_json parameter receives the actual Service Account JSON rather than
the encoded string.
75116a3 to
d854481
Compare
williaby
force-pushed
the
renovate/major-github-actions
branch
from
d854481 to
c5d5216
Compare
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Summary
Why
Scheduled patch update, bug fixes and security patches with no API changes.
Changes
This PR contains the following updates:
v1.5.2→v4.1.0v4.3.1→v6.0.2v4→v6v4.2.2→v6.0.2v4.9.0→v5.0.0v4→v8v5.6.0→v6.2.0v4.6.2→v7.0.1v4→v7v4→v7v6.8.0→v8.1.0v4.2.0→v8.1.0v4.6.0→v6.0.1v3.0.3→v4.0.1v3.35.3→v4.36.0v2→v3v2→v3v9.21.1→v10.5.3Warnings (1)
Please correct - or verify that you can safely ignore - these warnings before you merge this PR.
actions/attest-build-provenance: Could not determine new digest for update (github-tags package actions/attest-build-provenance)Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Impact
Acceptance Criteria
Testing
Notes
Release Notes
actions/attest-build-provenance (actions/attest-build-provenance)
v4.1.0Compare Source
What's Changed
actions/attestfrom 4.0.0 to 4.1.0 by @bdehamer in #838@actions/attestfrom 3.0.0 to 3.1.0 by @bdehamer in actions/attest#362@actions/attestfrom 3.1.0 to 3.2.0 by @bdehamer in actions/attest#365subject-versioninput for inclusion in storage record by @bdehamer in actions/attest#364Full Changelog: actions/attest-build-provenance@v4.0.0...v4.1.0
v4.0.0Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v3.2.0...v4.0.0
v3.2.0Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v3.1.0...v3.2.0
v3.1.0Compare Source
What's Changed
New Contributors
Full Changelog: actions/attest-build-provenance@v3...v3.1.0
v3.0.0Compare Source
What's Changed
v2.327.1
Release Notes
Make sure your runner is updated to this version or newer to use this release.
Full Changelog: actions/attest-build-provenance@v2.4.0...v3.0.0
v2.4.0Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v2.3.0...v2.4.0
v2.3.0Compare Source
What's Changed
actions/attestfrom 2.2.1 to 2.3.0 by @bdehamer in #615@sigstore/ocifrom 0.4.0 to 0.5.0Full Changelog: actions/attest-build-provenance@v2.2.3...v2.3.0
v2.2.3Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v2.2.2...v2.2.3
v2.2.2Compare Source
What's Changed
workflow.reffield from therefclaim in the OIDC token (actions/toolkit#1969)Full Changelog: actions/attest-build-provenance@v2.2.1...v2.2.2
v2.2.1Compare Source
What's Changed
@actions/attestv1.6.0Full Changelog: actions/attest-build-provenance@v2.2.0...v2.2.1
v2.2.0Compare Source
What's Changed
subject-checksumsinput parameterFull Changelog: actions/attest-build-provenance@v2.1.0...v2.2.0
v2.1.0Compare Source
What's Changed
attestation-idandattestation-urloutputs by @bdehamer in #415Full Changelog: actions/attest-build-provenance@v2.0.1...v2.1.0
v2.0.1Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v2.0.0...v2.0.1
actions/checkout (actions/checkout)
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
actions/dependency-review-action (actions/dependency-review-action)
v5.0.0: 5.0.0Compare Source
This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version v2.327.1 to run.
What's Changed
New Contributors
Full Changelog: actions/dependency-review-action@v4.9.0...v5.0.0
actions/download-artifact (actions/download-artifact)
v8Compare Source
v7Compare Source
v6Compare Source
v5Compare Source
actions/setup-python (actions/setup-python)
v6.2.0Compare Source
What's Changed
Dependency Upgrades
/__tests__/databy @dependabot in #1253 and #1264Full Changelog: actions/setup-python@v6...v6.2.0
v6.1.0Compare Source
What's Changed
Enhancements:
pip-installinput by @gowridurgad in #1201Dependency and Documentation updates:
allow-prereleasesby @yarikoptic in #979New Contributors
Full Changelog: actions/setup-python@v6...v6.1.0
v6.0.0Compare Source
What's Changed
Breaking Changes
Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes
Enhancements:
pip-versionby @priyagupta108 in #1129Bug fixes:
Dependency updates:
New Contributors
Full Changelog: actions/setup-python@v5...v6.0.0
actions/upload-artifact (actions/upload-artifact)
v7.0.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v7...v7.0.1
v7.0.0Compare Source
v7 What's new
Direct Uploads
Adds support for uploading single files directly (unzipped). Callers can set the new
archiveparameter tofalseto skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. Thenameparameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.ESM
To support new versions of the
@actions/*packages, we've upgraded the package to ESM.What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v6...v7.0.0
v6.0.0Compare Source
v6 - What's new
Node.js 24
This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
What's Changed
Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0
v5.0.0Compare Source
What's Changed
BREAKING CHANGE: this update supports Node
v24.x. This is not a breaking change per-se but we're treating it as such.@actions/artifacttov4.0.0v5.0.0by @danwkennedy in #734New Contributors
Full Changelog: actions/upload-artifact@v4...v5.0.0
astral-sh/setup-uv (astral-sh/setup-uv)
v7Compare Source
v6Compare Source
v5Compare Source
codecov/codecov-action (codecov/codecov-action)
v6.0.1Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1
v6.0.0Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0
v5.5.4Compare Source
This is a mirror of
v5.5.2.v6will be released which requiresnode24What's Changed
Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4
v5.5.3Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3
v5.5.2Compare Source
What's Changed
Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2
v5.5.1Compare Source
What's Changed
codecov-cliversion reference example by @webknjaz in #1774Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1
v5.5.0Compare Source
What's Changed
Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0
v5.4.3Compare Source
What's Changed
Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3
v5.4.2Compare Source
What's Changed
Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.1..v5.4.2
v5.4.1Compare Source
What's Changed
Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.0..v5.4.1
v5.4.0Compare Source
What's Changed
use_pypibypasses integrity checks too by @webknjaz in #1773Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.1..v5.4.0
v5.3.1Compare Source
What's Changed
Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.0..v5.3.1
v5.3.0Compare Source
What's Changed
Full Changelog: https://github.com/codecov/codecov-action/compare/v5.2.0..v5.3.0
v5.2.0Compare Source
What's Changed
Full Changelog: https://github.com/codecov/codecov-action/compare/v5.1.2..v5.2.0
v5.1.2Compare Source
What's Changed
${{ inputs.token }}inaction.ymlby @jwodder in #1721Full Changelog: https://github.com/codecov/codecov-action/compare/v5.1.1..v5.1.2
v5.1.1Compare Source
What's Changed
Full Changelog: https://github.com/codecov/codecov-action/compare/v5.1.0..v5.1.1
v5.1.0Compare Source
What's Changed
Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.7..v5.1.0
v5.0.7Compare Source
What's Changed
Configuration
📅 Schedule: Branch creation - "after 10pm every weekday,before 5am every weekday,every weekend" in timezone America/New_York, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.